[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

| Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. |
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Introduction ...................................................................................................................... | 2                                                                                |
|                                                                                | Purpose...................................................................................................................... | 3                                                                                |
|                                                                                | Scope.........................................................................................................................

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide to Computer Security Log Management:

articularly for getting logs from key devices (e.g., firewalls and network intrusion detection systems that often transfer large amounts of log data) and for transferring log data between log servers.
During a widespread malware incident or other network-based attack, regular networks might be unstable or unavailable. Another motivation for using a separate logging network is protecting log data on the organization's regular networks from eavesdropping. If a separate logging network is not used, logging communications on the regular network could be protected using additional security controls, such as data encryption. Another benefit of having a separate logging network is protecting those components that are only used for log management from attacks.

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Recommendation for Cryptographic Key Generation:

| SP 800-38B   | Dworkin MJ (2016) Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication . (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-38B, Includes updates as of October 06, 2016. https://doi.org/10.6028/NIST.SP.800-38B                       |
|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SP 800-38F   | Dworkin MJ (2012) Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping . (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-38F. https://doi.org/10.6028/NIST.SP.800-38F                                                                        |
| SP 800-56A   | Barker EB, Chen L, Roginsky A, Vassilev A, Davis R(2018) Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography . (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-56A, Rev. 3. https://doi.org/10.6028/NIST.SP.800-56Ar3       |
| SP 800-56B   | Barker EB, Chen L, Roginsky A, Vassilev A, Davis R, Simon S (2019) Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography . (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-56B, Rev. 2. https://doi.org/10.6028/NIST.SP.800-56Br2. |
| SP 800-56C   | Barker EB, Chen L, Davis R (2018) Recommendation for Key-Derivation Methods in Key-Establishment Schemes . (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-56C, Rev. 1.

Recommendation for Cryptographic Key Generation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Approaches for Federal Agencies to Use the Cybersecurity Framework:

Organizations manage many types of risk. They develop policies to identify, assess, and mitigate adverse effects with cybersecurity dependencies across various types of enterprise risks. In addition to cybersecurity risks, other typical enterprise risks include safety, financial, program, acquisitions, supply chain, and privacy. Many of these other types of risk may also have cybersecurity risk implications or be impacted by cybersecurity. Some employ different terminologies and risk management approaches to make decisions. OMB Circular A-123 establishes an expectation for federal agencies to proactively consider and address risks through an integrated, organization-level view of events, conditions, or scenarios that impact mission achievement. Organizations may have established a unique lexicon for ERM that should be

The Cybersecurity Framework can be used to translate risk management practices and to support federal agencies as they interact with suppliers, including service providers, product vendors, systems integrators, organizations within a regulated sector, and other private sector partners.

Cybersecurity Framework Profile can be incorporated into the acquisition process as a foundation for evaluation criteria (agency), solicitation response (supplier), proposal/quote review (agency), minimum contract requirements (agency), contract compliance evidence (supplier), and contract compliance verification (agency). The use of Cybersecurity Framework Profiles allows suppliers the flexibility to select from among various standards and practices to

Approaches for Federal Agencies to Use the Cybersecurity Framework


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI):

| 1 | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------| | 1.1 APPLICABILITY, INTENDED AUDIENCE, AND USAGE ...................................................................3 | | | 1.2 CHANGES FOR THIS REVISION .....................................................................................................4 | | | 1.3 TIMELINES FOR USING THE REVISED GUIDELINES........................................................................4 | | | 1.4 KEY RELATED NIST PUBLICATIONS ...........................................................................................5 | | | 1.5 ORGANIZATION OF THIS SPECIAL PUBLICATION | ..........................................................................5 | | 2.PREPARATIONFORASSESSMENTANDAUTHORIZATION ......................................

Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for the Secure Deployment of IPv6 provide? (Part 5)

[Assistant]
|      |
| 2.
| Document Structure ...............................................................................................1-1                                                                                | Document Structure ...............................................................................................1-1                                                                                |      |
| Introduction to IPv6....................................................................................................... | Introduction to IPv6....................................................................................................... | Introduction to IPv6.......................................................................................................

Guidelines for the Secure Deployment of IPv6

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile:

Include cybersecurity considerations in the risk management strategy. Review and update the risk management strategy as determined necessary. Determine and allocate required resources to protect the manufacturing system. | 62443-2-1:2009 4.2.3.1, 4.2.3.3, 4.2.3.8, 4.2.3.9 PM-9, PM-11   |
| IDENTIFY   | Risk Assessment (ID.RA) | ID.RA-1       | Low and Moderate Develop a plan to identify, document, and report vulnerabilities that exist on the manufacturing system. Include the use of vulnerability scanning where safe and feasible on the manufacturing system, its components, or a representative system. Develop a plan for continuous monitoring of the security posture of the manufacturing system to facilitate ongoing awareness of vulnerabilities. Conduct risk assessments on the manufacturing system that take into account vulnerabilities and potential impact to manufacturing operations and assets. High Conduct performance/load testing and penetration testing on the manufacturing system with care | 62443-2-1:2009 4.2.3, 4.2.3.7, 4.2.3.9, 4.2.3.12 CA-2 CA-7 RA-3 |
| IDENTIFY   | Risk Assessment (ID.RA) |               | to ensure that manufacturing operations are not adversely impacted by the testing process. Identify where manufacturing system vulnerabilities may be exposed to adversaries. Production systems may need to be taken off-line before testing can be conducted. If the manufacturing system is taken off-line for testing, tests are scheduled to occur during planned manufacturing outages whenever possible. If penetration testing is performed on non- manufacturing networks, extra care is taken to ensure that tests do not propagate into the manufacturing network. | CA-2(2), RA-5(4)                                                |
| IDENTIFY   | Risk Assessment (ID.RA) | ID.RA-2       | Low and Moderate Establish and maintain ongoing contact with security groups and associations, and receive security alerts and advisories.

Cybersecurity Framework Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS):

Profile                                                                                | ........................................................................................
3                                      |
|                                                                                | 1.3                                                                                | Audience......................................................................................................... 4             |
|                                                                                | 1.4                                                                                | Organization.................................................................................................... 4              |
| 2                                                                                | Profile Basics...........................................................................................................6      |                                                                                |
|                                                                                | 2.1 Profile Topics and Requirements, Augmentations, and Features                                                                | ...................

A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST Cloud Computing Forensic Science Challenges provide?

[Assistant]
## NISTIR 8006

## NIST Cloud Computing Forensic Science Challenges

Martin Herman

Michaela Iorga

Ahsen Michael Salim

Robert H. Jackson

Mark R. Hurst

Ross Leo

Richard Lee

Nancy M. Landreville

Anand Kumar Mishra

Yien Wang

Rodrigo Sardinas

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8006

<!-- image -->

## NISTIR 8006

## NIST Cloud Computing Forensic Science Challenges

## Martin Herman

Information Access Division Information Technology Laboratory

## Michaela Iorga

Computer Security Division Information Technology Laboratory

Ahsen Michael Salim

American Data Technology, Inc. Research Triangle Park, NC

Robert H. Jackson Mark R. Hurst SphereCom Enterprises Inc. Marshall, VA

Ross Leo

University of Houston-Clear Lake CyberSecurity Institute Houston, TX

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8006

August 2020

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology

Richard Lee

Citizens Financial Group Johnston, RI

## Nancy M. Landreville

MELE Associates (Germantown, MD) and Univ. of Maryland, GC (Adelphi, MD)

Anand Kumar Mishra Malaviya National Institute of Technology Jaipur, India

Yien Wang Rodrigo Sardinas Auburn University

Auburn, AL

## National Institute of Standards and Technology Interagency or Internal Report 8006 87 pages (August 2020)

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8006

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

NIST Cloud Computing Forensic Science Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to PIV Data Model Test Guidelines:

## bytes shall identify the version number of that supplier's minutiae detection algorithm. AS05.02.07:  The two most significant bytes of each of the two fields ("Owner" and "Type") of the CBEFF Product Identifier shall identify the vendor, and the two least significant

used to sign the facial image e extended key usage extension. TE06.03.17.01: The tester shall validate that the certificate that was biometric data asserts the id-PIV-content-signing OID in th rtificate used to sign the biometrics shall be determined by the expiration of the card in accordance with Table 3-3 AS06.03.18: The size of the public key for digital signature ce of SP 800-78. | DTR from Section 6   | Test Assertion from Section 10                                  | DTR Description                                                                                |
|----------------------|-----------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| TE06.03.07.02        | 10.3.1.13: Verify digital signature                             | s omitted, the tester shall validate that the certificate in the SignedData for the If the certificates field i CHUID can verify the digital signature in the SignerInfo. |
| TE06.03.08.01        | 10.3.1.5: Verify crls field omission                            | om the SignedData. The tester shall validate that the crls field has been omitted fr                                                                                |
| TE06.03.09.01        | 10.3.1.6: Verify contents of signerInfos                        | The tester shall validate that only a single SignerInfo exists in the SignedData.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Hardware-Enabled Security_ Policy-Based Governance in Trusted Container Platforms:

orchestration. A common desire is to only use cloud servers physically located within the same country as the organization, or physically located in the same country as the origin of the information.
Whenever multiple container deployments are present on a single cloud server, there is a need to segregate those deployments from each other so that they do not interfere with each other, gain access to each other's sensitive data, or otherwise compromise the security or privacy of the containers. NIST IR 8320A, Hardware-Enabled Security: Container Platform Security Prototype [1] provides an overview of challenges organizations may face when using cloud-based container workloads, as well as techniques to improve the security of cloud computing and accelerate the adoption of cloud computing technologies by establishing an automated hardware root-of-trust method for enforcing and monitoring platform integrity and geolocation restrictions for cloud servers.

Hardware-Enabled Security_ Policy-Based Governance in Trusted Container Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide to Operational Technology (OT) Security:

There may be references in this publication to other publications currently under development by NIST in
accordance with its assigned statutory responsibilities. The information in this publication, including concepts and
methodologies, may be used by federal agencies even before the completion of such companion publications. Thus,
until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain
operative. For planning and transition purposes, federal agencies may wish to closely follow the development of
these new publications by NIST.

computer security; distributed control systems (DCS); industrial control systems (ICS);
information security; network security; operational technology (OT); programmable logic
controllers (PLC); risk management; security controls; supervisory control and data acquisition
(SCADA) systems.

The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test
methods, reference data, proof of concept implementations, and technical analyses to advance
the development and productive use of information technology. ITL’s responsibilities include the
development of management, administrative, technical, and physical standards and guidelines for
the cost-effective security and privacy of other than national security-related information in
federal information systems. The Special Publication 800-series reports on ITL’s research,
guidelines, and outreach efforts in information system security, and its collaborative activities
with industry, government, and academic organizations.

Guide to Operational Technology (OT) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Physical Protection?

[Assistant]
According to Security Segmentation in a Small Manufacturing Environment:

Throughout this paper, a fictional small manufacturer that operates a facility is used as an example. Figure 1 below shows a fictional company's assets and network. This diagram is representative of what may be found in a small manufacturing environment. In reality, manufacturing environments vary in complexity from this example.

A security zone is a group of assets that have similar operational function and criticality; they share common cybersecurity requirements. Assets that have similar operational function often have similar system attributes and need similar protections; they may directly interact with each other and with the surrounding systems in a similar manner. The assets within the security zone have trusted communications with each other. Communication from inside a security zone to outside of the security zone is considered untrusted and subject to security controls. Security zones need to have physical or virtual boundaries to separate them from other security zones. A set of security practices that meets common security requirements is applied either at the security zone edge or within the security zone or both.

Some possible security zones and sample assets within each security zone are listed below. A facility may not have all of these assets and some assets may be owned by the property manager, internet service provider (ISP), or other vendor. More security zone examples can be found in the six-step approach later in the document.

Security Segmentation in a Small Manufacturing Environment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Computer Security_ Selected Articles:

ment is in a position to lead the development of contingency plans for centralized data processing facilities. Because they must take the lead in contingency planning and in assuring the physical safety of the facilities under their immediate control, it does not follow that there is supporting rationale for the assignment to the DP area of responsibility for all data security. The people best equipped to mount the more sophisticated intrusions into the data processing complexes, who are most often described in the general and trade press as posing a major security threat because of their technical strength, report to the data processing management and are usually in the second and third salary quintiles. Contrary to conventional wisdom, these people are responsible for only a very small portion of employee theft through misuse of the data processing resources. To the extent that we have security problems presented by the technically strong employees, they usually do not involve theft but more commonly reflect £ desire to do harm to the organization as a result of morale problems of one type or another. There is a striking correlation between the amount of damage done by technically oriented data processing people and the imminence of such potentially disruptive events as mergers, acquisitions, and divestitures, which threaten the stability of the current DP organization This aspect of computer security, unlike the overall data secuny problem, is best controlled by the DP management to whom those people report. - Provide advice and consultation to the user community on computer security matters. - Maintain awareness of the state-of-the-art in computer security through professional organizations and peer contacts so as to bring early awareness to the DP staff and the users of significant developments in both security' measures and evolving problem categories. - Administer the access control package(s) which run on facilities under control of the DP organization.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Digital Identity Guidelines_ Federation and Assertions:

| 1. Introduction . . . . . . . . . . . . . | 1. Introduction . . . . . . . . . . . . . | 1. Introduction . . . . . . . . . . . . . |
|---------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------|
|                                                                                | 1.1. . . . . . . . . . . . . . . . | Notations . . . . . . . . . . . . . . . . . . . 1                                     |
|                                                                                | 1.1.1. Cryptographic Terminology . | . . . . . . . . . . . . . . . . . . . 2                                               |
| 1.2. | Document Structure . . . . . . . . . | . . . . . . . . . . . . . . . . . . . 3                                               |
| 2. Federation Assurance Level (FAL) . . . . . . . . . . . . . . . . . . . . . . . . 4 | 2. Federation Assurance Level (FAL) . . . . . . . . . . . . . . . . . . . . . . . . 4 | 2. Federation Assurance Level (FAL) . . . . . . . . . . . . . . . . . . . . . . . . 4 |
|                                                                                | 2.1. . . . . | Common FAL Requirements . . . . . . . . . . . . . . . . . . . . 5                     |
|                                                                                | 2.2. | Federation Assurance Level 1 (FAL1) . . . . . . . . . . . . . . . . . . . . 6         |
|                                                                                | 2.3. | Federation Assurance Level 2 (FAL2) . . . . . . . . . . . . . . . . . . . . 6         |
|                                                                                | 2.4. | Federation Assurance Level 3 (FAL3) . . . . . . . . . . . . . . . . . . . . 7         |
| 2.5.

Digital Identity Guidelines_ Federation and Assertions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Non-Fungible Token Security:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0:

| Function | Category | | Subcategory | |------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------| | | Risk Assessment (ID.RA-P): The organization understands the privacy risks to individuals and how such privacy risks may create follow-on impacts on organizational operations, including mission, functions, other risk management priorities (e.g., compliance, financial), reputation, workforce, and culture.

NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters:

widely deployed technology can be used to safely expedite the transmission of voter registration and ballot request materials, as well as blank ballots. The same message may be provided to all voters.
In such cases, the information in the announcement is considered public information and therefore is not sensitive. This document will not discuss best practices for the distribution of these election information materials. However, ensuring the availability and reliability of the systems used to disseminate this information is important, and jurisdictions are directed to NISTIR 7682, Information System Security Best Practices for UOCAVA Supporting Systems [2], for information on security best practices to guard against accidental or malicious threats to system availability.

Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance:

purposes that are shared by various Microsoft protocols and applications, and by other applications that may choose to use them. There is a similar 'Keychain' facility in the Apple operating systems.
Some applications, intended to be portable between operating systems, can maintain their own root certificate stores and also have a feature that allows them to share a root certificate store with other applications. 6

Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Assessing Information Security Continuous Monitoring (ISCM) Programs_ Developing an ISCM Program Assessment:

3.2.1 Plan Step... 3.2.1 Plan Step... 3.2.1 Plan Step

The Plan Step of the ISCM program assessment defines the assessment process and formalizes the conduct of a program assessment as illustrated in Figure 5.

Assessing Information Security Continuous Monitoring (ISCM) Programs_ Developing an ISCM Program Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to Protecting the Confidentiality of Personally Identifiable Information (PII):

it does not know about. This document uses a broad definition of PII to identify as many potential sources of PII as possible (e.g., databases, shared network drives, backup tapes, contractor sites).
PII is -any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.‖ 6 Examples of PII include, but are not limited to:

Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide to Cyber Threat Information Sharing:

Many organizations handle information that, by regulation, law, or contractual obligation, requires protection. This includes PII, CUI, and other sensitive information afforded protection under the Sarbanes-Oxley Act (SOX), the Payment Card Industry Data Security Standard (PCI DSS), the Health Information Portability and Accountability Act (HIPAA), the Federal Information Security Modernization Act of 2014 (FISMA), and the Gramm-Leach-Bliley Act (GLBA) and other legislation, regulations, and guidelines. Organizations should identify and properly protect such information. An organization's legal team, privacy officers, auditors, and experts familiar with the various regulatory frameworks should be consulted when developing procedures for identifying and protecting sensitive information.

Organizations should establish policies and procedures that address the disposition of indicators (and threat information in general). Policies and procedures should define data retention requirements for short (online) and long (offline) term availability of indicator information. Information handling and retention requirements may change once threat information is entered into evidence. Evidence acquired during any incident investigations, for instance, should be collected and preserved using best practices for data preservation following chain of custody requirements and other laws pertaining to the submission of evidence. A more detailed treatment of forensic techniques related to chain of custody and preserving information integrity is available in NIST Special Publication 800-86 [12] and Section 3.3.2 of NIST Special Publication 800-61 [1].

fixes the vulnerability, and the security operations team deploys logging and intrusion detection signatures to identify any similar future attacks.

Guide to Cyber Threat Information Sharing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Approaches for Federal Agencies to Use the Cybersecurity Framework:

Cybersecurity Framework Profile can be incorporated into the acquisition process as a foundation for evaluation criteria (agency), solicitation response (supplier), proposal/quote review (agency), minimum contract requirements (agency), contract compliance evidence (supplier), and contract compliance verification (agency). The use of Cybersecurity Framework Profiles allows suppliers the flexibility to select from among various standards and practices to

Using a Cybersecurity Framework Profile also may help identify opportunities for improving management of the organization's cybersecurity workforce and how it achieves defined risk tolerance outcomes. One way to do that is by applying the NICE Workforce Framework from the National Initiative for Cybersecurity Education (NICE), documented in SP 800-181 [13]. That workforce framework serves as a fundamental reference. It offers organizations a consistent lexicon for categorizing and describing cybersecurity work by category, specialty area, and work role, as well as a superset of cybersecurity knowledge, skills, and abilities (KSAs) and tasks for each work role. These elements support consistent organizational and sector communication for cybersecurity education, training, and workforce development. While the Cybersecurity Framework and the NICE Framework were developed separately, they complement each other by describing a hierarchical approach to achieving cybersecurity goals. The NICE program is in the process of determining alignment among Cybersecurity Framework subcategory outcomes and NICE Work Roles. As this work progresses, the alignment will help agencies document current and desired outcomes (based on Framework Core Subcategories) as well as the types of personnel that might have a role in accomplishing those outcomes.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Attribute Considerations for Access Control Systems:

3.2.1                                                                                | Attribute Trustworthiness... 3.2.1 Attribute Trustworthiness

Attribute trustworthiness considers how well the sources of attributes are authenticated, identified, and validated. 3.2.1.

Attribute Considerations for Access Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Information Security Guide for Government Executives:

ul, executives need to understand how to systematically recognize and address information security risks and take steps to understand and manage these risks through their information security program.
Information and information systems serve as a fundamental enabler for Federal agencies to meet their primary objective of serving the American public-making the confidentiality, integrity, and availability of information paramount to the Federal government's ability to deliver services to the American public. Information security should be closely aligned with business or mission goals. The cost of protecting information and information assets should not exceed the value of the assets. To properly align business risks and information security, management should facilitate a cooperative discussion between business units and information security managers.

Information Security Guide for Government Executives


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0:

The TOE will provide user services directly or serve as a platform for networked applications and will support protected communications across an untrusted network.

FDP\_ACC.1.1  The TSF shall enforce the [ assignment: CSPP access control SFP] on [ assignment: all subjects, all operating system controlled files (to include all communications mechanisms - for internal or external communications - that are implemented as objects controlled by the file system), and all access requests to these files].

FPT\_RPL.1.1-CSPP  The TSF shall detect replay for the following entities [ extension: security state information that is critical to maintaining a secure state among distributed systems as identified in [ ST assignment: list of TSF data requiring such protection] ].  The ST rationale shall provide a basic justification, showing that the ST assignment is complete.  It is acceptable to protect all communications, rather than selecting specific entities.

COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Information Security Guide for Government Executives:

| Information Security Program Elements | Information Security Program Elements | |-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Awareness and Training | The security awareness and training program is a critical component of the information security program.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines for Media Sanitization:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. - Hard copy. Hard copy media refers to physical representations of information, typically paper printouts, film, microfiche, etc. However, printer and facsimile ribbons, drums, and platens are also examples of hard copy media. The supplies associated with producing paper printouts are often the most uncontrolled. Hard copy materials containing sensitive data that leave an organization without effective sanitization expose a significant vulnerability to 'dumpster divers' and overcurious employees. - Information storage media (ISM).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to Bluetooth Security:

Several Bluetooth versions are currently in use in commercial devices, while the most current version can be found at bluetooth.com. At the time of writing, Bluetooth 4.0 (adopted June 2010) is the most prevalent. The most recent versions include Bluetooth 4.1 and Bluetooth 4.2. Bluetooth 4.1 (adopted December 2013) improved the strengths of the Basic Rate/Enhanced Data Rate (BR/EDR) technology cryptographic key, device authentication, and encryption by making use of Federal Information Processing Standard (FIPS)-approved algorithms. Bluetooth 4.2 (adopted December 2014) improved the strength of the low energy technology cryptographic key by making use of FIPS-approved algorithms, and provided means to convert BR/EDR technology keys to low energy technology keys and vice versa. This publication addresses the security of all versions of Bluetooth. most secure, and for Bluetooth 2.0 and older devices Security Mode 3 is recommended. Security Modes 2 and 4 can also use authentication and encryption, but do not initiate them until after the Bluetooth physical link has already been fully established and logical channels partially established. Security Mode 1 devices never initiate security and therefore should never be used.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices provide? (Part 4)

[Assistant]
ors also gratefully acknowledge and appreciate the many comments from the public and private sectors whose thoughtful and constructive comments improved the quality and usefulness of this publication.
## Note

NIST Special Publication (SP) 800-60 may be used by organizations in conjunction with a family of security-related publications including:

- FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems;
- FIPS Publication 200, Minimum Security Controls for Federal Information Systems ;
- NIST SP 800-30, Risk Management Guide for Information Technology Systems 1 ;
- NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems;
- NIST Draft SP 800-39, Managing Risk from Information Systems: An Organizational Perspective;
- NIST SP 800-53, Recommended Security Controls for Federal Information Systems;
- NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems ; and
- NIST SP 800-59, Guideline for Identifying an Information System as a National Security System . This series of nine documents is intended to provide a structured, yet flexible framework for selecting, specifying, employing, and evaluating the security controls in Federal information systems-and thus, make a significant contribution toward satisfying the requirements of the Federal Information Security Management Act (FISMA) of 2002. While the publications are mutually reinforcing and have some dependencies, in most cases, they can be effectively used independently of one another. This is Volume II of two volumes. Volume I contains the basic guidelines for mapping types of information and information systems to security categories. The appendices contained in Volume II include security categorization recommendations and rationale for mission-based and management and support information types.

Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Recommendation for Block Cipher Modes of Operation_ Galois_Counter Mode (GCM) and GMAC:

| Table of Contents | Table of Contents | Table of Contents | Table of Contents | |-------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 | PURPOSE...........................................................................................................................................................1 | PURPOSE...........................................................................................................................................................1 | PURPOSE...........................................................................................................................................................1 | | 2 | AUTHORITY.....................................................................................................................................................1 | AUTHORITY.....................................................................................................................................................1 | AUTHORITY.....................................................................................................................................................1 | | 3 | INTRODUCTION..............................................................................................................................................1 | INTRODUCTION..............................................................................................................................................1 | INTRODUCTION..............................................................................................................................................1 | | 4 DEFINITIONS, ABBREVIATIONS, AND SYMBOLS.................................................................................2 | 4 DEFINITIONS, ABBREVIATIONS, AND SYMBOLS.................................................................................2 | 4 DEFINITIONS, ABBREVIATIONS, AND SYMBOLS.................................................................................2 | 4 DEFINITIONS, ABBREVIATIONS, AND SYMBOLS.................................................................................2 | | 4.1 | 4.1 | DEFINITIONS AND ABBREVIATIONS .............................................................................................................2 | | | 4.2 | 4.2 | SYMBOLS ....................................................................................................................................................5 | | | 4.2.1 | 4.2.1 | Variables................................................................................................................................................5 | | | 4.2.2 | 4.2.2 | Operations and Functions .....................................................................................................................6 | | | 5 ELEMENTS OF GCM......................................................................................................................................7 | 5 ELEMENTS OF GCM......................................................................................................................................7 | 5 ELEMENTS OF GCM......................................................................................................................................7 | | | 5.1 | 5.1 | BLOCK CIPHER ............................................................................................................................................7 | | | 5.2 | 5.2 | TWO GCMFUNCTIONS ...............................................................................................................................7 | | | 5.2.1 | 5.2.1 | Authenticated Encryption Function .......................................................................................................8 | | | 5.2.2 | 5.2.2 | Authenticated Decryption Function.......................................................................................................9 | | | 5.3 | 5.3 | PRIMITIVES FOR CONFIDENTIALITY AND AUTHENTICATION........................................................................9 | | | 6 MATHEMATICAL COMPONENTS OF GCM...........................................................................................10 | 6 MATHEMATICAL COMPONENTS OF GCM...........................................................................................10 | 6 MATHEMATICAL COMPONENTS OF GCM...........................................................................................10 | | |

Recommendation for Block Cipher Modes of Operation_ Galois_Counter Mode (GCM) and GMAC


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach:

-  Compromising  the  software  development  toolchain  (e.g.,  compilers,  linkers,  interpreters,
continuous integration tools, code repositories). This allows malicious code to be inserted by
the adversary without modifying the source code or without the knowledge of the software
developers.

Cyber resiliency is based on the recognition that adversaries can establish and maintain a covert
presence  in  systems.  Therefore,  many  cyber  resiliency  techniques  and  approaches  are  not
predicated on the assumption of successfully detecting adversity, including cyber-attacks. These
include  the  Coordinated  Protection,  Deception,  Diversity,  Non-Persistence,  Realignment,
Redundancy, Substantiated Integrity, and Unpredictability techniques, and the Fragmentation,
Distributed  Functionality,  Predefined  Segmentation,  Attribute-Based  Usage  Restriction,  and
Trust-Based Privilege Management approaches.

Two cyber resiliency techniques directly involve the detection of adversity or its effects: Analytic
Monitoring  and  Contextual  Awareness.  The  Substantiated  Integrity  technique  and  the
Consistency Analysis approach support detection of some effects of adversity.

Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case provide?

[Assistant]
## NISTIR 8183A Volume 3

## Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide:

Volume 3 -Discrete-based Manufacturing System Use Case

Keith Stouffer Timothy Zimmerman CheeYee Tang Jeffrey Cichonski Michael Pease Neeraj Shah Wesley Downard

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8183A-3

<!-- image -->

## NISTIR 8183A Volume 3

## Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide:

Volume 3 -Discrete-based Manufacturing System Use Case

Keith Stouffer Timothy Zimmerman CheeYee Tang Michael Pease Intelligent Systems Division Engineering Laboratory

Neeraj Shah Strativia, LLC Largo, Maryland

Jeffrey Cichonski Applied Cybersecurity Division Information Technology Laboratory

Wesley Downard G2, Inc. Annapolis Junction, Maryland

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8183A-3

September 2019

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology

Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

## National Institute of Standards and Technology Internal Report 8183A, Volume 3 296 pages (September 2019)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8183A-3

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide to Attribute Based Access Control (ABAC) Definition and Considerations:

| Audience .........................................................................................................................
| Audience ......................................................................................................................... | 1     |
| 1.3                                                                                | Document Structure ...................................................................................................... | Document Structure ...................................................................................................... | 1     |
| 1.4                                                                                | Notes on Terminology ................................................................................................... | Notes on Terminology ................................................................................................... | 2     |
| 2. Understanding ABAC .......................................................................................................... | 2. Understanding ABAC .......................................................................................................... | 2. Understanding ABAC .......................................................................................................... | 4     |
| 2.1 The Benefit of ABAC ..................................................................................................... | 2.1 The Benefit of ABAC ..................................................................................................... | 2.1 The Benefit of ABAC .....................................................................................................

Guide to Attribute Based Access Control (ABAC) Definition and Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Glossary of Key Information Security Terms provide? (Part 3)

[Assistant]
tems. ## Abstract

This publication describes an online glossary of terms used in National Institute of Standards and Technology (NIST) and Committee on National Security Systems (CNSS)  publications.
This glossary utilizes a database of terms extracted from NIST Federal Information Processing Standard Publications (FIPS), the NIST Special Publication (SP) 800 series, select NIST Interagency or Internal Reports (NISTIRs), and from the Committee for National Security Systems Instruction 4009 (CNSSI-4009). ## Keywords

cybersecurity; definitions; glossary; information assurance; information security; terminology. ## Supplemental Content

The online glossary described in this publication is publicly available at https://csrc.nist.gov/glossary. ## Table of Contents

|   1 | Introduction ............................................................................................................1   |
|-----|------------------------------------------------------------------------------------------------------------------------------|
| 2   | Methodology...........................................................................................................2      |
| 2.2 | Data ................................................................................................................ 3      |
| 2.3 | Web Application.............................................................................................. 4              |

## 1 Introduction

The  National  Institute  of  Standards  and  Technology  (NIST)  has  created  an  easily-accessible repository of terms and definitions extracted verbatim from NIST Federal Information Processing Standard  Publications  (FIPS),  NIST  Special  Publications  (SPs),  and  select  NIST  Internal  or Interagency  Reports  (IRs),  as  well  as  from  the  Committee  on  National  Security  Systems Instruction 4009 (CNSSI-4009).

Glossary of Key Information Security Terms

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guidelines for API Protection for Cloud-Native Systems:

Another distinguishing feature of the controls recommended for protecting APIs is the capacity to provide assurance for conforming to the principles of zero trust. This is because there is no distinction between internal and external API requests or calls due to the absence of an identifiable network perimeter and the distributed nature of applications on-premises and in multiple clouds. This security assurance can be achieved with authentication and authorization controls using identity-based segmentation [2]. Documents that provide recommendations on the configuration of authentication and authorization controls in the context of cloud-native applications (e.g., [2][3]) are also relevant in the context of configuring controls for API protection.

- Missing authentication (e.g., tokens can be present but simply not checked), often due to a bug or misconfiguration in the application
- Weak or predictable tokens, default accounts, and default passwords (e.g., a hard-coded bootstrap account with the same username and password on all devices, test accounts with predictable names and weak/guessable passwords)

For runtime protections for APIs, apply zero trust principles as a baseline, and augment them with additional policy on requests and their payloads.

Guidelines for API Protection for Cloud-Native Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Information Security Handbook_ A Guide for Managers:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of nonnational-security-related information in federal information systems. This Special Publication 800 series reports on ITL's research, guidelines, and outreach efforts in information system security and its collaborative activities with industry, government, and academic organizations. - The Federal Information Security Management (FISMA) Act is the primary legislation governing federal information security programs, building upon earlier legislation through added emphasis on the management dimension of information security. - -FISMA delegates to the National Institute of Standards and Technology (NIST) the responsibility to develop detailed information security standards and guidance for federal information systems, with the exception of national security systems. - -FISMA designates to OMB the oversight of federal agencies' information security implementation. - -FISMA provides a comprehensive framework for securing federal government IT resources, including defining key federal government and agency roles and responsibilities, requiring agencies to integrate information security into their capital planning and enterprise architecture processes, requiring agencies to conduct annual information security reviews of all programs and systems, and reporting the results of those reviews to OMB.

Information Security Handbook_ A Guide for Managers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Service Mesh Proxy Models for Cloud-Native Applications:

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/233/final, including related content, potential updates, and document history. | October 2024                                                                                | October 2024                                                                                | Cloud-Native Applications   |
|-------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------|
| 5.2.7. | Denial of Service (TR-7)...........................................................................................................19           |                             |
| 5.2.8.

Service Mesh Proxy Models for Cloud-Native Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide for Conducting Risk Assessments:

feguards and/or countermeasures (i.e., security controls), in which adversaries change some characteristic of their intent/targeting in order to avoid and/or overcome those safeguards/countermeasures.
Threat shifting can occur in one or more domains including: (i) the time domain (e.g., a delay in an attack or illegal entry to conduct additional surveillance); (ii) the target domain (e.g., selecting a different target that is not as well protected); (iii) the resource domain (e.g., adding resources to the attack in order to reduce uncertainty or overcome safeguards and/or countermeasures); or (iv) the attack planning/attack method domain (e.g., changing the attack weapon or attack path). Threat shifting is a natural consequence of a dynamic set of interactions between threat sources and types of organizational assets targeted. With more sophisticated threat sources, it also tends to default to the path of least resistance to exploit particular vulnerabilities, and the responses are not always predictable. In addition to the safeguards and/or countermeasures implemented and the impact of a successful exploit of an organizational vulnerability, another influence on threat shifting is the benefit to the attacker. That perceived benefit on the attacker side can also influence how much and when threat shifting occurs.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendation for Existing Application-Specific Key Derivation Functions:

|                             | 3. The computation of a digital signature from data, 4. The verification of a digital signature, 5. The computation of an authentication code from data, 6. The verification of an authentication code from data and a received authentication code. |
|-----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Key agreement primitive     | A DLC primitive specified in SP 800-56A [SP 800-56A] or an RSA Secret Value Encapsulation (RSASVE) operation specified in SP 800-56B [SP 800-56B]. |
| Key derivation key          | A key that is used as an input to a key derivation function or key expansion function to derive other keys. |
| Nonce                       | A time-varying value that has at most a negligible chance of repeating; for example, a random value that is generated anew for each use, a time-stamp, a sequence number, or some combination of these. It can be a secret or non-secret value. |
| Pre-shared key              | A secret key that is established between communicating parties before a communication protocol starts. |
| Pseudorandom function (PRF) | A function that can be used to generate output from a random seed and a data variable, such that the output is computationally indistinguishable from truly random output. |
| Pseudorandom key            | As used in this Recommendation, a binary string that is taken from the output of a PRF. |
| Secret keying material      | The binary data that is used to form secret keys, such as AES encryption keys or HMAC keys. |
| Shall                       | This term is used to indicate a requirement that needs to be fulfilled to claim conformance to this Recommendation. Note that shall may be coupled with not to become shall not.

Recommendation for Existing Application-Specific Key Derivation Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Risk Management for Replication Devices provide? (Part 3)

[Assistant]
xploits; mitigation; multifunction devices; printers; replication devices; risk; risk assessment; risk management; scanners; security controls; System Development Life Cycle; threats; vulnerabilities.
## Table of Contents

| Table of Contents......................................................................................................................................... iv    |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction .............................................................................................................................................. 1 |
| 1.1 Background.......................................................................................................................................... 1       |
| 1.2 Purpose and Applicability ................................................................................................................... 1              |
| 1.3 Target Audience................................................................................................................................... 2         |
| 1.4 Document Structure............................................................................................................................. 2            |
| 2. Threats and Vulnerabilities ..................................................................................................................... 3           |
| 2.1 General Threats and Vulnerabilities ................................................................................................... 3                    |
| 2.2 Network Connectivity Threats and Vulnerabilities ..............................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security of SQL-Based Implementations of Product Data Exchange Using STEP provide? (Part 4)

[Assistant]
six IRs and two APs. Note that PDES is not a standard. PDES stands for Product Data Exchange Using STEP. PDES 'refers to the United States contributing effort to this standardization process' [FCF93].
## 1.3 Using This Document

This paper will be most useful to people who are familiar with SQL or relational database management systems. The reader is also assumed to have a basic knowledge of computer security or to have previously read [PB93]. Finally, the document also assumes some familiarity with STEP, although it is not required. SQL is a general purpose tool that could be used to implement STEP in various ways. Section 2, SQL/STEP Architecture, presents a basic architecture for an SQL-based implementation of STEP. This section examines security considerations that are of increased importance for this architecture. Section 3 identifies controls and mechanisms that can be used to address the concerns described in Section 2. These controls are organized according to an augmented Trusted Computer System Evaluation Criteria (TCSEC) model presented in [PB93]. This model reflects the Trusted Database Interpretation (TDI) [TDI91] and National Computer Security Center (NCSC) Technical Report 79-91, Integrity In Automated Information Systems [TR791]. The Interpreted Requirements presented in the TDI provide the basis for discussions of labels and audit in database. Additions to the model from TR 79-91 include the definitions of data integrity and systems integrity. STEP itself does not imply any particular implementation form or security policy. Certain policies are more easily implemented with the SQL/STEP architecture than others. In Section 4, three broad classes of security policies are briefly described, accompanied by a comparison of particular requirements with the facilities of SQL. The policy classes are: a role based policy, a mandatory access control policy for confidentiality, and a mandatory access control policy for integrity.

Security of SQL-Based Implementations of Product Data Exchange Using STEP

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Trustworthy Email:

�is document gives recommendations and guidelines for enhancing trust in email . �e primary audience includes enterprise email administra tors, information security specialists and network managers. �is guideline applies to federal IT systems and will also be useful for small or medium sized organizations. Technologies recommended in support of core Simple Mail Transfer Protocol (SMTP) and the Domain Name System (DNS) include mechanisms for authenticating a sending domain: Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM) and Domain based Message Authentication, Reporting and Conformance (DMARC). Recommendations for email transmission security include Transport Layer Security (TLS) and associated certificate authentication protocols. Recommendations for email content security include the encryption and authentication of message content using S/MIME (Secure/Multipurpose Internet Mail Extensions) and associated certificate and key distribution protocols.

Email; Simple Mail Transfer Protocol (SMTP); Transport Layer Security (TLS); Sender Policy Framework (SPF); Domain Keys Identified Mail (DKIM); Domain based Message Authentication, Reporting and Conformance (DMARC); Authentication of Named Entities (DANE); S/MIME; OpenPGP.

�e Internet's underlying core email protocol, Simple Mail Transport Protocol (SMTP), was first adopted in 1982 and is still deployed and operated today. However, this protocol is susceptible to a wide range of attacks including man -in-themiddle content modification and content surveillance. �e basic standards have been modified and augmented over the years with adaptations that mitigate some of these threats. With spoofing protection, integrity protection, encryption and authentication, properly implemented email systems can be regarded as sufficiently secure for governme nt, financial and medical communications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Service Mesh Proxy Models for Cloud-Native Applications:

| October 2024                                                                                | October 2024                                                                                | Cloud-Native Applications   |
|-------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------|
| 5.2.7. | Denial of Service (TR-7)...........................................................................................................19           |                             |
| 5.2.8.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Key Practices in Cyber Supply Chain Risk Management_ Observations from Industry:

In today's highly connected, interdependent world, all organizations rely on others for critical products and services. However, the reality of globalization, while providing many benefits, has resulted in a world where organizations no longer fully control-and often do not have full visibility into-the supply ecosystems of the products that they make or the services that they deliver. With more and more businesses becoming digital, producing digital products and services, and moving their workloads to the cloud, the impact of a cybersecurity event today is greater than ever before and could include personal data loss, significant financial losses, compromise of product integrity or safety, and even loss of life. Organizations can no longer protect themselves by simply securing their own infrastructures since their electronic perimeter is no longer meaningful; threat actors intentionally target the suppliers of more cyber-mature organizations to take advantage of the weakest link. Cybersecurity risks associated with this loss of control (and visibility) can be significant. They range from unknown provenance of hardware or software that supports an organization's digital functions to subcontractors and consultants having access to its critical data. This phenomenon is referred to as cybersecurity aspects of C-SCRM. Over the last decade, C-SCRM has evolved from a narrow focus on information and communication technology (ICT) supply chains to covering any cybersecurity-related supply chain risk. Today, it encompasses an increasing array of digital products and services that continues to grow with the expanding role of cyber space in the daily lives of individuals and in how business is conducted.

Key Practices in Cyber Supply Chain Risk Management_ Observations from Industry


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. In today's cloud data centers and edge computing, attack surfaces have shifted and, in some cases, significantly increased. At the same time, hacking has become industrialized, and most security control implementations are not coherent or consistent. The foundation of any data center or edge computing security strategy should be securing the platform on which data and workloads will be executed and accessed. The physical platform represents the first layer for any layered security approach and provides the initial protections to help ensure that higher-layer security controls can be trusted. This report explains hardware-enabled security techniques and technologies that can improve platform security and data protection for cloud data centers and edge computing. In the scope of this document, the hardware platform is a server (e.g., application server, storage server, virtualization server) in a data center or edge compute facility. The server's hardware platform, also called the server platform , represents the first part of the layered security approach. Hardware-enabled security -security with its basis in the hardware platform-can provide a stronger foundation than one offered by software or firmware, which has a larger attack surface and can be modified with relative ease.

Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

the Federal Information Security Modernization Act of 2014 (FISMA), the Privacy Act of 1974, OMB policies, and Federal Information Processing Standards, among other laws,  regulations,  and  policies.
The  scope  of  this  publication  pertains  to  federal  information systems,  which  are  discrete  sets  of  information  resources  organized  for  the  collection, processing, maintenance, use, sharing, dissemination, or disposition of information, whether such information is in digital or non-digital form. Information resources include information and related resources, such as personnel, equipment, funds, and information technology.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Configuration Management?

[Assistant]
According to Computer Security Division 2009 Annual Report:

- Issued sixteen NIST Special Publications (SP) covering management, operational, and technical security guidance, as well as four NIST Interagency Reports (NISTIRs) on technical topics, and one revised Federal Information Processing Standard (FIPS);
- Collaborated with the Office of the Director of National Intelligence,  Committee  on  National  Security  Systems,  and the  Department of Defense to establish a common foundation for information security across the federal government,  including  a  consistent  process  for  selecting  and specifying  safeguards  and  countermeasures  (i.e.,  security controls) for federal information systems;
- Provided  assistance  to  agencies  and  private  sector. Conducted  ongoing,  substantial  reimbursable  and  non-reimbursable  assistance  support,  including  many  outreach efforts  such  as  the  Federal  Information  Systems  Security Educators' Association (FISSEA), the Federal Computer Security  Program Managers' Forum (FCSPM Forum), and the Small Business Corner;
- o Drafted NISTIR 7621, Small Business Information Security:  The  Fundamentals ,  which  was  released  in  August 2009. NISTIR  7621  helps  small  businesses  and  other small organizations implement the fundamental components of an effective information security program;
- o Initiated the development of an outreach video for the Small Business Outreach to help promote Information Technology (IT) security awareness for small to medium sized businesses. This video is expected to be publicly available in October 2009 on the CSRC website;
- Evaluated security policies and technologies from the private sector and national security systems for potential federal agency use. Assembled a growing repository of federal agency security practices, public/private security practices, and  security  configuration  checklists  for  IT  products.

Computer Security Division 2009 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

---------------------------------------|
| IDENTIFY   | Asset Management (ID.AM) | ID.AM-1       | Low Impact Document an inventory of manufacturing system components that reflects the current system.
Manufacturing system components include for example PLCs, sensors, actuators, robots, machine tools, firmware, network switches, routers, power supplies, and other networked components or devices. System component inventory is reviewed and updated as defined by the organization. Information deemed necessary for effective accountability of manufacturing system components includes, for example, hardware inventory specifications, component owners, networked components or devices, machine names and network addresses. Inventory specifications include, for example, manufacturer, device type, model, serial number, and physical location. | ISA/IEC 62443-2- 1:2009 4.2.3.4 ISA/IEC 62443-3- 3:2013 SR 7.8 CM-8 |
| IDENTIFY   | Asset Management (ID.AM) | ID.AM-1       | Moderate Impact                                                                                | ISA/IEC 62443-2- 1:2009 4.2.3.4 ISA/IEC 62443-3- 3:2013 SR 7.8 CM-8 |
| IDENTIFY   | Asset Management (ID.AM) | ID.AM-1       | Identify individuals who are both responsible and accountable for administering manufacturing system components.

Cybersecurity Framework Version 1.1 Manufacturing Profile